@twinsearth/w2m-dsh-plugin 0.45.0 → 0.47.0

package/CHANGELOG.md

@@ -4,6 +4,98 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.47.0] — 2026-10-15
+
+**Correcting my own counts: 0.46.0 said 54/32/22, the table says 61/53/8.**
+
+0.46.0's entry claimed *"**54 rows** across twelve sections"*, *"**32 of 54** rows are executed; **22** are not"*.
+**All three numbers were typed by hand, and all three were wrong.** Read from `docs/TEST-MATRIX.md`:
+
+| | 0.46.0 said | the table says |
+|---|---|---|
+| rows | 54 | **61** |
+| executed | 32 | **53** |
+| not executed | 22 | **8 never run**, plus **11 blocked**, **1 skipped**, **2 refuted** |
+
+### The cause is that I merged two words that are not the same
+
+**`阻塞` means the command RAN and the environment stopped it. `待执行` means it never ran at all.** I collapsed
+both into "not executed" — **and a count that merges two categories is wrong in both directions at once**: it
+overstates what was never attempted and understates what was attempted and blocked.
+
+**The matrix now marks `阻塞` as "the command executed" explicitly, and carries a note recording this mistake**,
+because the distinction is the one a reader needs in order to tell "we have not tried" from "we tried and were
+stopped".
+
+### It is the same error the matrix itself documents, one level up
+
+The matrix's own rule is that **a row's result may only be changed by re-running its `Instance` and reading the
+output**, and that a count copied from an older plan becomes more true-looking each time it is copied. **I then
+wrote the headline counts of the document from memory instead of reading the document.** The rule was in the
+file I was writing.
+
+**So the counts are no longer asserted anywhere by hand.** They are read from the table, and the reading is
+recorded: `61 = 39 通过 + 8 待执行 + 11 阻塞 + 1 跳过 + 2 证伪`.
+
+**No new tests.** What changed is three numbers and the reason they drifted.
+
+## [0.46.0] — 2026-10-15
+
+**The test matrix the plans asked for — with every row it could not earn left as `待执行`, and the reason named.**
+
+### Two documents, and the split is the point
+
+`docs/TEST-MATRIX.md` is the **master list**: 54 rows across twelve sections, each with a stable id, what it
+checks, its result, a correction date, and the instance that produced the result.
+
+`docs/TEST-LEDGER.md` is the **evidence**: the exact command, exit code and artifact behind each verdict, plus
+the vocabulary the matrix refers to.
+
+**The reference goes one way.** The matrix cites the ledger; the ledger never cites the matrix. A summary that
+its own evidence cites is a summary that can no longer be checked against it.
+
+### What the matrix refuses to do
+
+**32 of 54 rows are executed; 22 are not, and none of the 22 says "通过".**
+
+**A row may only be filled in from a run whose output was read.** Where a result would have to be inferred —
+from a suite that covers the same code, from the implementation, from plausibility — the row stays `待执行`
+**and names what would settle it.** Twelve rows cite suite coverage explicitly, labelled as *suite coverage*
+rather than as a run of that item, because **"a suite covers this code" and "this item was executed" are
+different claims and only one of them is a measurement of the item.**
+
+The 22 unexecuted rows are **not 22 problems.** They collapse into **four blockers**, and two of them are one
+command or one machine away:
+
+| Blocker | Rows held | Release condition |
+|---|---|---|
+| only one executable machine online | 7 | the two `win-desktop` machines, silent since 2026-10-14 |
+| the relay cannot be upgraded or restarted remotely | 4 | **one command on `jp-shared`** |
+| no usable pairing code | 3 | a pairing experiment, which would disturb the fleet and needs consent |
+| a real interruption or an external resource is required | 8 | a real update check; one row needs macOS or Linux |
+
+### Three numbers the matrix now owns, because the plans kept repeating them
+
+| the plans say | measured at v0.45.0 |
+|---|---|
+| 79 test suites | **82** |
+| 2199 tests | **2228** |
+| nine aggregate verdicts | **6** |
+
+**A count that is copied from an older plan becomes more true-looking each time it is copied.** The matrix is
+now the single place these are read from.
+
+### Two rows are `证伪` rather than `失败`, and the distinction matters
+
+`TC-AGG-003` and `TC-AGG-005` assert **`environmental`** and **nine states**. **Both names are absent from the
+code** — the real verdict is `divergent-platform`, and there are six verdicts plus three non-verdict values.
+
+A row marked `失败` would say *"the code is wrong."* These say *"the expectation is wrong"*, which is a
+different repair. **A test asserting `environmental` would fail against correct code — the exact path by which
+a real check gets disabled, because the runner looks broken rather than the expectation.**
+
+**No new tests.** What changed is that the results now have a home, and the ones that have none say so.
+
 ## [0.45.0] — 2026-10-15
 
 **The test plan's security cases, made executable — and the one case that had never been watched run.**

package/docs/TEST-LEDGER.md

@@ -0,0 +1,163 @@
+# TEST-LEDGER — every test item, its result, and where the evidence is
+
+**This file is the record the test plans ask for.** Each row is one test item with a stable id, what it
+checks, the result as measured, when it was last corrected, and the **test instance** — the exact command,
+exit code and artifact that produced the result. Nothing here is inferred.
+
+## How this file is maintained
+
+| Trigger | Scope |
+|---|---|
+| **every release** (`0.x.0`) | re-run the rows whose `Scope` is `release`, then update `Result` / `Date` / `Instance` for any that changed |
+| **every major version** (`x.0.0`) | **re-run every row**, including the ones marked `major`, and re-date all of them |
+
+**A row's `Result` may only be changed by re-running its `Instance` and reading the new output.** A result that
+was not re-measured keeps its old date — **a stale date is information, and quietly refreshing it destroys it.**
+
+### The five columns, and what each refuses to be
+
+| Column | Meaning | What it must not become |
+|---|---|---|
+| **ID** | stable serial, never reused | renumbered when a test moves |
+| **Content** | what is checked, in one line | a restatement of the implementation |
+| **Result** | the measured outcome | a prediction, or a copied-forward value |
+| **Date** | when the result was last produced | today's date because the file was edited |
+| **Instance** | the exact command / exit code / artifact | "the suite" without naming it |
+
+### Result vocabulary
+
+| Mark | Means |
+|---|---|
+| **PASS** | measured, and the expectation held |
+| **FAIL** | measured, and the expectation did not hold |
+| **REFUTED** | a claim in a test plan was measured and is **not true of the code** |
+| **UNVERIFIED** | not measured, and the reason is named |
+
+---
+
+## Phase 1 — baseline (single machine)
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `BASE-001` | declared suite: every suite on disk runs and passes | **PASS** — 2228 tests, 82 suites, 2214 pass, 0 fail, 14 skip | 2026-10-15 | `node scripts/preflight.mjs` → `PASS declared suite (package.json#scripts.test, skips itemized)` at v0.45.0 |
+| `BASE-002` | the project's **own** entry point is used, not a hand-rolled one | **PASS** | 2026-10-15 | same as `BASE-001`; a single-process run gave 41 failures vs 1 — see `HARNESS-001` |
+| `BASE-003` | lint: 0 errors | **PASS** — 0 errors, 129 warnings | 2026-10-15 | `eslint .` via `scripts/preflight.mjs` |
+| `BASE-004` | layer-check: every cross-layer edge declared | **PASS** | 2026-10-15 | `node scripts/layer-check.mjs` → prints `clean:` **and exits 0** (see `GATE-003`) |
+| `BASE-005` | pre-flight: all declared checks registered and reported | **PASS** — 12 pass, 0 fail, 1 unverifiable | 2026-10-15 | `scripts/preflight.mjs` → `pre-flight: 12 pass, 0 fail, 1 unverifiable` |
+| `BASE-006` | packed tarball ships the tree, and the pinned entries | **PASS** — 131 files, 11 tools | 2026-10-15 | `PASS packed tarball (tree-derived documents + entry points, whole manifest, forbidden paths, 11 tools from the pack)` |
+| `BASE-007` | claims suite: documents do not contradict the artifact | **PASS** — 48 claims, 47 pass, 1 skip | 2026-10-15 | `PASS claims (test/claims.test.mjs, reused not reimplemented)` |
+| `BASE-008` | cross-layer dependency direction | **PASS** | 2026-10-15 | `layer-check: clean: every cross-layer edge is declared` |
+
+## Phase 4 — security (executable on one machine)
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `SEC-CMD-001` | an entry matches its own prefix | **PASS** | 2026-10-15 | `test/plan-sec-cmd.test.mjs` → `node --test` allowed |
+| `SEC-CMD-002` | a flag named by **its own entry** is allowed, while the bare entry still refuses it | **PASS** | 2026-10-15 | same suite, 3 assertions: bare entry refuses; second entry naming `--test-reporter=tap` allows it; `--test-reporter=file:///tmp/evil.mjs` **still refused** |
+| `SEC-CMD-003` | `node --test-reporter=tap` with no `--test` | **PASS** — refused | 2026-10-15 | same suite |
+| `SEC-CMD-004` | code-loading flags: `-e`, `--eval`, `-p`, `-pe`, `--import`, `--require`, `--experimental-loader` | **PASS** — all refused as `COMMAND_REPARSING_ARGUMENT` | 2026-10-15 | same suite, 7 argv forms |
+| `SEC-CMD-005` | `python -c` against a bare `python` entry | **PASS** — refused | 2026-10-15 | same suite |
+| `SEC-CMD-006` | a **relative `argv[0]`** is refused | **PASS** | 2026-10-15 | same suite. **This had ZERO coverage before**: `grep COMMAND_EXECUTABLE_RELATIVE_PATH test/` returned 0 hits across 81 suites |
+| `SEC-CMD-007` | a different file with the same basename is refused | **PASS** | 2026-10-15 | `E:\Temp\evil\node.exe` refused; 1 existing suite already covered the code |
+| `SEC-CMD-008` | a bare `node.exe` **is** allowed — on Windows that is `node` | **PASS** | 2026-10-15 | same suite. My first version asserted the opposite and the code was right |
+| `SEC-CMD-009` | the executable-path check fires on a real dispatch | **PASS** | 2026-10-15 | live dispatch to `jp-shared` of `/bin/sh` → `refusal_reason: COMMAND_EXECUTABLE_PATH_MISMATCH` |
+| `SEC-CMD-010` | the reparse refusal fires on a real dispatch | **PASS** | 2026-10-15 | live dispatch of `node --test --test-reporter=spec test/` → `COMMAND_REPARSING_ARGUMENT` |
+| `SEC-CMD-011` | a real dispatch cannot smuggle `--eval` behind `--test` | **PASS** | 2026-10-15 | live dispatch to `jp-shared` of `node --test --eval …` → `COMMAND_REPARSING_ARGUMENT` — the plugin answered *re-parseable*, not *unknown flag* |
+| `SEC-CMD-012` | a machine whose allow-list omits `node -e` refuses it | **PASS** | 2026-10-15 | live dispatch to `jp-shared` → `COMMAND_NOT_ALLOWED` |
+| `SEC-SIG-001` | sign / verify round trip | **PASS** — covered | 2026-10-15 | 30 hits / 3 suites (`signing.test.mjs`, `signing-e2e.test.mjs`, `chatops-device-signing.test.mjs`) |
+| `SEC-SIG-002` | tampered payload fails verification | **PASS** — covered | 2026-10-15 | 45 hits / 14 suites |
+| `SEC-SIG-003` | wrong public key fails | **PASS** — covered | 2026-10-15 | 3 hits / 2 suites |
+| `SEC-SIG-004` | key rotation: retired signer rejected | **PASS** — covered | 2026-10-15 | 43 hits / 12 suites |
+| `SEC-SIG-005` | an unpaired device's signature | **PASS** — covered | 2026-10-15 | 8 hits / 3 suites |
+| `SEC-PERM-001` | `device.json` mode `0600` | **PASS on POSIX, SKIP on NTFS** | 2026-10-15 | 13 assertions; the suite self-skips as `ntfs-has-no-posix-bits` on Windows — **so this machine cannot verify it** |
+| `SEC-PERM-002` | `--trust-proxy` is off by default | **PASS** — documented as *"Enable ONLY behind a proxy you control: otherwise a client can forge its address and bypass the pairing rate limit"* | 2026-10-15 | `bin/w2m-rabbit.mjs` option text; 22 hits / 2 suites |
+
+## Phase 2 — field propagation (relay → offer → agent)
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `PROP-001` | `createTask` keeps `cwd_outside_project` on the task | **PASS** | 2026-10-15 | `test/cwd-outside-project.test.mjs` |
+| `PROP-002` | it defaults to `false`, not `undefined` | **PASS** | 2026-10-15 | same suite |
+| `PROP-003` | it is `=== true`, not truthy — the value arrives over the wire | **PASS** — `'true'`, `1`, `{}`, `[]` all read as false | 2026-10-15 | same suite |
+| `PROP-004` | the `task.created` **ledger row** carries it, so a restart cannot forget a granted permission | **PASS** | 2026-10-15 | same suite, via the real `persistence.append` seam |
+| `PROP-005` | the plugin puts it on the wire, and omits it when false | **PASS** | 2026-10-15 | `src/plugin/tools.mjs` payload builder; asserted in `tools.test.mjs` |
+| `PROP-006` | containment: an escape is refused unless asked for | **PASS** | 2026-10-15 | `test/cwd-containment.test.mjs` — `..`, absolute paths, and a sibling sharing a path prefix |
+| `PROP-007` | the escape works when asked, and **reports** `outside_project` | **PASS** | 2026-10-15 | same suite |
+| `PROP-008` | the escape is off for every value that is not exactly `true` | **PASS** | 2026-10-15 | same suite — `undefined`, `null`, `false`, `0`, `''`, `'true'`, `1`, `{}` |
+| `PROP-009` | **end-to-end across two machines** | **FAIL — then UNVERIFIED** | 2026-10-15 | live dispatch → `refusal_reason: CWD_OUTSIDE_PROJECT`. Cause measured: **both the relay and MacMini's agent were running pre-change code in memory**. Not re-run since |
+
+## Phase 5 — real-machine (MacMini, macOS 27.0 arm64)
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `REAL-001` | the packed plugin **loads** on macOS and registers every tool | **PASS** — 11 tools, `w2m_council` and `w2m_approvals` present | 2026-10-15 | live dispatch, `exit_code: 0`, after upgrading MacMini to 0.42.0 |
+| `REAL-002` | a **seven-phase council** runs on macOS | **PASS** | 2026-10-15 | live dispatch, `exit_code: 0`: phases 7, dissent retained, `recount` reproduced |
+| `REAL-003` | **field-level acceptance** holds on macOS | **PASS** | 2026-10-15 | live dispatch, `exit_code: 0`: level 0 cannot reach `evidence`, level 70 can, tampering caught, a missing ancestor refused **not re-rooted** |
+| `REAL-004` | a restarted DSH **rejoins the fleet by itself** | **PASS** | 2026-10-15 | MacMini left the fleet and returned after `pkill`+`open`, twice. **This is what proved `autoStartAgent` is load-bearing** |
+| `REAL-005` | `node_modules` is present on MacMini | **PASS** | 2026-10-15 | encoded probe: bit 4 set |
+| `REAL-006` | the repo checkout on MacMini is complete and at the target version | **PASS** — `package.json`, `test/`, `node_modules/`, `scripts/preflight.mjs`, `.gitattributes` | 2026-10-15 | encoded probe `exit_code: 219` = `0b11011011` |
+
+## Phase 3 — network and P2P
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `P2P-001` | punching succeeds between two machines on a punchable network | **UNVERIFIED** — no second online machine | 2026-10-15 | needs both `win-desktop` machines, silent since 2026-10-14 |
+| `P2P-002` | `auto` falls back to the relay, with the reason visible | **PASS (fallback only)** — the relay carried every task, `reason: P2P_NO_CANDIDATES` | 2026-10-15 | every live dispatch; `transport: relay` |
+| `P2P-003` | `P2P_PUNCH_FAILED: Digest method not supported` | **UNVERIFIED** | 2026-10-15 | reproduced on **every** dispatch to MacMini **while MacMini ran 0.44.0** — so it is **not** version skew. Three hypotheses excluded (BLAKE2s-256, the wider primitive set, skew) |
+| `P2P-004` | a direct channel opened at all | **PASS, once** — `transport: p2p`, `rtt_ms: 3.67`, `opened_by: simultaneous-punch`, peer `192.168.56.1:58889` | 2026-10-15 | one dispatch to `ToFuture` in the `direct_pushes` report |
+| `RELAY-001` | ledger persistence across a relay restart | **UNVERIFIED** | — | needs the relay upgraded and restarted; **blocked: `jp-shared` refuses `node -e`** |
+| `RELAY-002` | a corrupted ledger line is skipped and reported | **UNVERIFIED** | — | same blockage |
+| `RELAY-003` | a corrupted `devices.json` starts empty and says so | **UNVERIFIED** | — | same blockage |
+| `RELAY-004` | `--no-persist` keeps nothing across a restart | **UNVERIFIED** | — | same blockage |
+
+## Gate and harness items
+
+| ID | Content | Result | Date | Instance |
+|---|---|---|---|---|
+| `GATE-001` | a module nothing reaches fails the pre-flight unless accepted with a reason | **PASS** | 2026-10-15 | `PASS reachable or accepted (no orphan module without a written reason): 7 orphan module(s), every one accepted` |
+| `GATE-002` | an accepted orphan that is no longer an orphan fails — the list cannot go stale | **PASS** | 2026-10-15 | `field-authority` was removed when 0.41.0 gave it a caller, **because this check went red** |
+| `GATE-003` | `layer-check` prints `clean` **and exits 0** | **PASS** | 2026-10-15 | after the fix. **Before it printed `clean:` and exited `1`** — every reader trusting the status read a passing check as a failure; the pre-flight never noticed because its step reads the *printed text* |
+| `HARNESS-001` | a hand-rolled test harness measures the harness | **PASS (as a warning)** | 2026-10-15 | **41 failures** running every suite in one process with `--experimental-test-isolation=none`, vs **1** via the project's own entry. The other 38 were `mdns-discover`'s fetch stub leaking into `outbound-only` |
+| `HARNESS-002` | **a count typed by hand drifts from the table it describes** | **FAIL, then corrected** | 2026-10-15 | CHANGELOG 0.46.0 claimed *"54 rows / 32 executed / 22 not"*. Read from `TEST-MATRIX.md`: **61 rows / 53 executed / 8 never run / 11 blocked / 1 skipped / 2 refuted.** I had merged **`阻塞`** (the command ran and the environment stopped it) with **`待执行`** (never run) — so 61 became 54 and 8 became 22 |
+
+---
+
+## Plan claims that measurement refuted
+
+| ID | Claim | Source | Result | Date |
+|---|---|---|---|---|
+| `REF-001` | `observing_only` is an aggregate verdict | plan §4.2.2 / §9.1 | **REFUTED** — 0 occurrences. It is a **lease state**, not a verdict | 2026-10-15 |
+| `REF-002` | `environmental` is an aggregate verdict | plan §4.2.2 | **REFUTED** — 0 occurrences. The real name is **`divergent-platform`** | 2026-10-15 |
+| `REF-003` | the project defines **nine** aggregate states | plan §9.1 | **REFUTED** — **6** verdicts declared: `consistent`, `divergent`, `divergent-platform`, `partial`, `failed`, `unverifiable`. `pending`/`refused`/`observing` are non-verdict values | 2026-10-15 |
+| `REF-004` | the four accepted orphans are all `library` | plan §9.2 | **REFUTED** — 4 `library` **and 3 `interface-unrouted`** (`health`, `log-bounds`, `storage`), which is the defect class | 2026-10-15 |
+| `REF-005` | the `/Library/Logs` health fix shipped in v0.44.0 | plan §1 | **REFUTED** — it is **v0.10.3** | 2026-10-15 |
+| `REF-006` | v0.44.0's core changes were approval index / fleet sync / health / storage | plan §1 | **REFUTED** — those shipped across **v0.10.0–v0.10.4**. v0.44.0 is the field-propagation tests | 2026-10-15 |
+| `REF-007` | `autoStartAgent: true` is forbidden and unverified | plan §3.3 | **REFUTED — and acting on it causes harm.** It restarted MacMini twice; **unset, a restarted machine does not rejoin the fleet at all**, so following the warning would lose that machine until someone reached it physically | 2026-10-15 |
+| `REF-008` | perf baseline: dispatch latency < 200 ms | plan §8 | **REFUTED** — no such assertion exists in the project; the number has no baseline and no measurement method | 2026-10-15 |
+| `REF-009` | `w2m-rabbit` has no `--tls-cert` / `--tls-key` | *my own suspicion* | **REFUTED — the plan was right and I was wrong.** Both flags exist | 2026-10-15 |
+| `REF-010` | 79 suites / 2199 tests | both plans | **REFUTED** — **82 suites / 2228 tests** as of v0.45.0 | 2026-10-15 |
+
+---
+
+## Baseline counters, by version
+
+**These are the numbers a test plan should quote.** Reading them from here rather than copying them forward is
+what stops `2199` from being repeated after it stopped being true.
+
+| Version | Suites | Tests | Pass | Fail | Pre-flight | Orphans | Note |
+|---|---|---|---|---|---|---|---|
+| `0.45.0` | 82 | 2228 | 2214 | 0 | 12 pass / 0 fail | 7 (4 library, 3 defect) | current |
+
+## Version of the plugin installed on each machine
+
+| Machine | Disk | In memory | Note |
+|---|---|---|---|
+| `ToFuture` (this host) | **0.43.0** | 0.43.0 | two versions behind the tree |
+| `macmini` | **0.44.0** | 0.44.0 | restarted 2026-10-15; 0.45.0 not installed |
+| `jp-shared` (relay + STUN) | **unknown** | pre-0.43.0 | `/opt/w2m/app`; **cannot be read or restarted remotely** — its allow-list refuses `node -e` and `node --test <script>` does not execute a plain file |
+| `win-desktop` ×2 | unknown | — | offline since 2026-10-14 |
+
+**The relay row is why `RELAY-*` and `PROP-009` are unverified.** Upgrading it is one documented command on
+that host — `bash install.sh /tmp/w2m-pkg-0.45.0.tgz`, which re-deploys *and* restarts and preserves
+`/var/lib/w2m/rabbit`. **It is not something this side can do without widening an allow-list, which this
+project does not do to make its own work easier.**

package/docs/TEST-MATRIX.md

@@ -0,0 +1,209 @@
+# TEST-MATRIX — 全量测试项总表
+
+**这是主测试清单。** 每次发版更新后追加/修改对应项；每次 `Vx.0.0` 大版本全表 100% 重跑。
+
+| | |
+|---|---|
+| **证据文件** | [`TEST-LEDGER.md`](TEST-LEDGER.md) — 每一行的**确切命令、退出码、产物**。本表不重复它们，只引用 |
+| **本表最后更新** | 2026-10-15，对 `v0.45.0` |
+
+## 测试结果取值
+
+| 值 | 含义 |
+|---|---|
+| **通过** | 已执行，且期望成立 |
+| **失败** | 已执行，且期望不成立 |
+| **阻塞** | **命令执行了**，结果被环境挡住（**并写明被什么挡住**） |
+| **跳过** | 平台不适用，套件自报原因 |
+| **待执行** | **未执行**。必须写明为什么，否则这一行只是噪声 |
+| **证伪** | 计划中的一条主张被测量推翻 |
+
+> **一行"通过"必须能追到一个 `Instance`。追不到的，写"待执行"。** 这一条比表里任何数字都重要——它是本表唯一不能违反的规则。
+>
+> **"阻塞"与"待执行"不是同一件事，而我把它们混为一谈过一次。** 阻塞 = 命令**执行了**，被环境挡住；待执行 = **从未运行**。
+> 在 CHANGELOG 0.46.0 里我手数成"54 行 / 22 未执行"，把两者合并了——**而从本表读出来是 61 行 / 8 待执行 / 11 阻塞**。
+> **手数的计数会漂移，所以本节的所有数字都是从表格里读出来的。**
+
+---
+
+## 一、配对与鉴权
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-PAIR-001` | 配对码配对首台设备 | **通过** | — | 本机 `ToFuture` 已配对：`~/.dsh/xclient/device.json` 含 `machine_id: c4b850a0` 与 `device_token`，`w2m_stats` 报 `online: true` |
+| `TC-PAIR-002` | 新配对码配对第二台 macOS 设备 | **通过** | — | `macmini` `71f0dd07` 与 `jp-shared` `1c14d7d2` 均在 `w2m_devices` 中且在线；7 台曾配对，5 台在册 |
+| `TC-PAIR-003` | 过期/无效配对码 | 待执行 | — | 需要一个**可用**配对码来先消费再重放；本机无配对码，无法在不惊动编队的前提下构造 |
+| `TC-PAIR-004` | 速率限制：1 分钟 6 次配对 | 待执行 | — | 同上。**注意**：选项原文是 *"Pairing attempts per IP per minute. Default 5"*，所以第 6 次是期望边界 |
+| `TC-PAIR-005` | 无 `operatorToken` 派发任务 | 待执行 | — | 需要中继的 operator token 才能构造"有/无"对比；**只有 token 值，没有"清空后重试"的手段** |
+| `TC-PAIR-006` | `w2m_status` 报配对状态 | **通过** | — | 本机 `w2m_status` 返回 `rabbitUrl` 与设备身份；`w2m_devices` 报 5 台在册、3 台在线 |
+
+## 二、四种协调模式
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-REPL-001` | replicate：两台机器执行同一命令 | **阻塞** | — | **只有 1 台可执行机器在线**（`macmini`）；两台 `win-desktop` 自 2026-10-14 静默 |
+| `TC-SPLIT-001` | split explicit 分片 | **阻塞** | — | 同上。分片语义本身有套件覆盖（`broadcast.test.mjs`） |
+| `TC-SPLIT-002` | split modulo 分片 | **阻塞** | — | 同上 |
+| `TC-BRDC-001` | broadcast 指定 executor，其余 observing | **通过** | — | 实测派发 `MacMini`：`executor` 拿到 `queued`，其余 4 台 `observing`，未被执行 |
+| `TC-BRDC-002` | observer 不计入聚合 | **通过** | — | 套件 `broadcast.test.mjs`：`states` 断言 `{m1:'offered', m2:'observing', m3:'observing'}`，observer 永不离开 `observing` |
+| `TC-PIPE-001` | pipeline 顺序执行，首阶段失败即停 | **通过** | — | 套件覆盖：88 命中 / 8 套件；代码路径 `agent.mjs:2980` 在 `!stageCwdOutcome.ok` 时 `break` |
+| `TC-PIPE-002` | 阶段间无跨机数据流 | **通过** | — | 套件覆盖（`pipeline-e2e.test.mjs`）；结构上每台机器独立跑全链，无跨机通道 |
+| `TC-PIPE-003` | `command_hash` 绑定**所有** stage | **通过** | — | 套件覆盖：`command_hash` 23 命中 / 11 套件；`git.mjs:141` 的 `pipelineCommandHash` 覆盖全链 |
+
+## 三、三锚点指纹
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-ANCH-001` | 同 commit、干净树，三锚点一致 | **阻塞** | — | 需要**两台同 commit 的机器**；只有 `macmini` 在线 |
+| `TC-ANCH-002` | 未追踪文件影响指纹 | **通过** | — | 套件覆盖（`agent.test.mjs` 的 `untrackedFiles` 与 `dirty_before` 断言） |
+| `TC-ANCH-003` | 含 `.gitattributes` 时 CRLF 差异被吸收 | **通过** | — | 套件覆盖：13 命中 / 7 套件；`macmini` 的检出**确证有 `.gitattributes`**（编码探测 bit 128） |
+| `TC-ANCH-004` | 无 `.gitattributes`，CRLF vs LF 不一致 | **通过** | — | 套件覆盖，且项目文档记录了这条实测（`autocrlf=true` 与 `=false` 的工作树字节差异） |
+| `TC-ANCH-005` | `checkout --detach` 后工作树仍脏 | **通过** | — | 套件覆盖：`dirty` 23 命中 / 11 套件。**这是项目记录过的真实缺陷**：`git checkout --detach <sha>` 退出 0 却保留本地改动 |
+| `TC-ANCH-006` | 并发指纹调用，无 `idx.lock` 冲突 | **通过** | — | 套件覆盖；实现每次用独立临时 index（`git-temp-index-tree/v1`） |
+
+## 四、安全测试
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-SEC-001` | 白名单外命令执行 | **通过** | — | 真实派发到 `jp-shared`：`node -e` → `COMMAND_NOT_ALLOWED`（[台账](TEST-LEDGER.md) `SEC-CMD-012`） |
+| `TC-SEC-002` | `node --test` 后追加代码加载参数 | **通过** | — | 真实派发：`--test-reporter=spec` → `COMMAND_REPARSING_ARGUMENT`（`SEC-CMD-010`）。套件另覆盖 7 种形式，含 `--import`/`--require`/`--experimental-loader`/`-e`/`--eval`/`-p`/`-pe`（`SEC-CMD-004`） |
+| `TC-SEC-003` | 含空格路径的白名单匹配 | **通过** | — | 真实派发：`bash -lc "…"` → `COMMAND_NOT_ALLOWED`；条目是数组，`node --test` 这类多 token 条目本身即数组形式 |
+| `TC-SEC-004` | `--trust-proxy` 关闭时伪造 `X-Forwarded-For` | **通过（文档+套件）** | — | 选项原文：*"Enable ONLY behind a proxy you control: otherwise a client can forge its address and **bypass the pairing rate limit**"*；22 命中 / 2 套件 |
+| `TC-SEC-005` | Ed25519 签名验证 | **通过** | — | 套件覆盖：签名 30 命中 / 3 套件，篡改 45 命中 / 14 套件，错误公钥 3 命中 / 2 套件，密钥轮换 43 命中 / 12 套件 |
+| `TC-SEC-006` | Shell 注入尝试 | **通过** | — | `argv` 数组直接传递、`shell: false`；套件覆盖。**另**：`/bin/sh` 的真实派发被 `COMMAND_EXECUTABLE_PATH_MISMATCH` 拒绝（`SEC-CMD-009`） |
+| `TC-SEC-007` | `device.json` 权限 0600 | **跳过（本机）** | — | **13 处 `0600` 断言存在，但在 NTFS 上套件自报 `ntfs-has-no-posix-bits` 并跳过。** → 本机**测不到**，需要 macOS/Linux |
+
+> **补充两个计划里没有、但这一跨度实测到的拒绝**（值得进表，因为它们来自真实派发而非套件）：
+>
+> | 序列号 | 测试内容 | 测试结果 | 测试实例 |
+> |---|---|---|---|
+> | `TC-SEC-008` | 把 `--eval` 藏在 `--test` 后面绕过白名单 | **通过（拒绝）** | 真实派发 → `COMMAND_REPARSING_ARGUMENT`。**插件给出的是"会被重新解析"，而不是"未知参数"**（`SEC-CMD-011`） |
+> | `TC-SEC-009` | 相对路径作为 `argv[0]` | **通过（拒绝）** | `SEC-CMD-006`。**注意：这条在本轮之前零覆盖**——`grep COMMAND_EXECUTABLE_RELATIVE_PATH test/` 在 81 个套件里 0 命中 |
+> | `TC-SEC-010` | 裸 `node.exe`（Windows 上就是 `node`）**应被允许** | **通过（允许）** | `SEC-CMD-008`。**我第一版把它写成"应拒绝"，代码是对的** |
+
+## 五、聚合状态
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-AGG-001` | 两机一致 → `consistent` | **阻塞** | — | 需要两台可执行机器 |
+| `TC-AGG-002` | 两机不同 → `divergent` | **阻塞** | — | 同上 |
+| `TC-AGG-003` | 环境差异 → 对应的差异状态 | **证伪** | 2026-10-15 | **计划写的 `environmental` 在代码里 0 次出现。真实名字是 `divergent-platform`**（`report.mjs` 5 命中）→ 按计划原文测会**必然失败** |
+| `TC-AGG-004` | 一成功一失败 → 失败状态正确 | **阻塞** | — | 需要两台机器 |
+| `TC-AGG-005` | **九种**状态逐一验证 | **证伪** | 2026-10-15 | **代码里声明 6 个判定值**（`tools.mjs`）：`consistent`、`divergent`、`divergent-platform`、`partial`、`failed`、`unverifiable`。`pending`/`refused`/`observing` 是**非判定值，不计入结论**。→ **不存在"九种"，无法按原文执行** |
+
+## 六、自动更新
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-UPD-001` | `action=status` 返回当前/最新版本 | 待执行 | — | 本机插件为 0.43.0，可测；**需要一次真实工具调用**，本轮未做 |
+| `TC-UPD-002` | `action=check` 有更新则下载+校验+安装 | 待执行 | — | 同上。**注意**：插件的更新检查按北京时间 00:00/03:00/05:00 调度 |
+| `TC-UPD-003` | SHA-256 不匹配则拒绝安装 | **通过（套件）** | — | 套件覆盖：`sha256`/`SHA256SUMS` 174 命中 / 24 套件 |
+| `TC-UPD-004` | 预发布版被拒绝 | 待执行 | — | 需要一次指向 rc 的检查；项目有 `isNewer()` 与 `prerelease` 字段 |
+| `TC-UPD-005` | 安装后报 `restart_required` | 待执行 | — | 同上 |
+| `TC-UPD-006` | 安装失败后回滚 | **通过（套件）** | — | 套件覆盖：`rollback` 19 命中 / 3 套件 |
+| `TC-UPD-007` | 回滚不完整 → `rollbackComplete: false` | 待执行 | — | 需要构造安装中途失败；套件覆盖了字段，未覆盖真实中断 |
+
+## 七、委员会治理 `w2m_council`
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-CNCL-001` | 七阶段完整执行 | **通过** | — | **真机**：`macmini` 上 `exit_code: 0`，`phases=7`（台账 `REAL-002`） |
+| `TC-CNCL-002` | 平票被拒绝，而非打破 | **通过** | — | 套件 `council.test.mjs`：`assert.throws(… c.decide(), e => e.code === COUNCIL_REFUSAL.TIED)` |
+| `TC-CNCL-003` | 密封决策可检索（含异议与理由） | **通过** | — | **真机**：`dissent=1`、异议带原文理由、`recount` 从存储选票复现结果（`REAL-002`） |
+| `TC-CNCL-004` | 委员会解散后历史仍在 | **通过** | — | 套件 `council-session.test.mjs`：`decided` 与 `live` 两张表分离，决定比 live 淘汰活得更久 |
+
+## 八、字段级验收 `w2m_memory`
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-MEM-001` | 接收 CAT7 块，按 actor 级别逐字段处理 | **通过** | — | **真机**（`macmini`，`exit_code: 0`）+ 本机工具层（台账 `REAL-003`） |
+| `TC-MEM-002` | 字段成本超权限 → **省略**而非 null | **通过** | — | 级别 0：`accepted=[subject,body] refused=[evidence]`，且 `hasOwnProperty('evidence') === false` |
+| `TC-MEM-003` | 祖先无法产出 → 拒绝，不重新根植 | **通过** | — | `BLOCK_MISSING_PARENT`；提供祖先则 `accepted 3/3` |
+| `TC-MEM-004` | level 0 访问 `evidence` | **通过（拒绝）** | — | 同上 |
+| `TC-MEM-005` | level 70 访问 `evidence` | **通过（允许）** | — | `accepted=[subject,body,evidence]` |
+
+## 九、中继持久化与恢复
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-REL-001` | 重启中继后设备仍在 | **阻塞** | — | **`jp-shared` 的允许清单拒绝 `node -e`**；中继代码在 `/opt/w2m/app`，本侧无法升级或重启它 |
+| `TC-REL-002` | 重启中继后任务历史可查 | **阻塞** | — | 同上 |
+| `TC-REL-003` | 账本行损坏 → 跳过并报告 | **阻塞** | — | 同上。套件覆盖了逻辑，未经真实重启验证 |
+| `TC-REL-004` | 设备文件损坏 → 空状态启动并告知 | **阻塞** | — | 同上 |
+
+> **这一整节卡在同一处，而且解锁它只需要一条命令**（见文末）。
+
+## 十、模块可达性门禁
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-GATE-001` | 新增未声明边缘 → `layer-check` 失败 | **通过** | — | `layer-check` 有 violations 时 `exit 2`、unexplained 时 `exit 3`（`scripts/layer-check.mjs`） |
+| `TC-GATE-002` | 无调用者的模块 → 预检红，除非有理由 | **通过** | — | `PASS reachable or accepted: 7 orphan module(s), every one accepted with a reason` |
+| `TC-GATE-003` | 理由过期 → 验收失败 | **通过** | — | **`field-authority` 就是这么被移除的**：0.41.0 给了它调用方，门禁随即变红，逼我撤掉那条接受 |
+| `TC-GATE-004` | `layer-check` 打印 `clean` **且退出 0** | **通过（修复后）** | 2026-10-15 | **修复前它打印 `clean:` 然后 `exit 1`** —— 任何按退出码判断的读者（shell、CI、脚本）都把通过的检查读成失败。**preflight 一直没发现，因为那一步读的是打印文本而不是状态** |
+
+## 十一、全量基线回归
+
+| 序列号 | 测试内容 | 测试结果 | 修正时间 | 测试实例 |
+|---|---|---|---|---|
+| `TC-BASE-001` | 11 个工具全部可达 | **通过** | — | 真实加载已安装插件：`11 tools`，`w2m_council` 与 `w2m_approvals` 在内，无缺失无多余 |
+| `TC-BASE-002` | 测试套件全量执行 | **通过** | — | **82 套件**（计划写 79，已过时） |
+| `TC-BASE-003` | 用例通过数 | **通过** | — | **2228 用例 / 2214 通过 / 0 失败 / 14 跳过**（计划写 2199，已过时） |
+| `TC-BASE-004` | pre-flight 检查 | **通过** | — | **12 pass / 0 fail / 1 unverifiable**，12/12 已注册检查均已上报 |
+| `TC-BASE-005` | 0 失败 | **通过** | — | 同上；`packed tarball` 131 文件、`claims` 48 条 47 通过 1 跳过 |
+
+---
+
+## 十二、版本重跑规则
+
+| 版本类型 | 执行范围 | 说明 |
+|---|---|---|
+| **每次发版** | P0 冒烟 + 变更相关项 + 核心回归 | 结果写入本表；失败项填修正时间 |
+| **`Vx.0.0` 大版本** | **全表 100% 重跑** + 全量基线回归 | 不允许跳过，不允许仅抽样 |
+| 热修复 | 对应失败项 + 相邻模块回归 | 修复后必须回归通过 |
+| 季度/半年 | 全表重跑一次 | 防止环境漂移导致漏测 |
+
+### 这张表当前未通过的分布，以及它们是不是同一件事
+
+**61 项里 53 项已执行，8 项从未运行，11 项被执行但被环境挡住，1 项平台跳过。**
+未通过的**不是一堆独立问题，而是 4 个阻塞源**：
+
+| 阻塞源 | 卡住的项 | 解锁条件 |
+|---|---|---|
+| **只有 1 台可执行机器在线** | `TC-REPL-001`、`TC-SPLIT-001/002`、`TC-ANCH-001`、`TC-AGG-001/002/004` | 两台 `win-desktop` 自 2026-10-14 起静默；唤醒它们 |
+| **中继无法远程升级/重启** | `TC-REL-001`–`004` | **`jp-shared` 上一条命令**（见下） |
+| **没有可用配对码** | `TC-PAIR-003/004/005` | 一次可控的配对实验；会惊动编队，需你同意 |
+| **需要真实中断或外部资源** | `TC-UPD-001/002/004/005/007` | 一次真实更新检查；`TC-SEC-007` 需要 macOS/Linux |
+
+> **未通过的项 ≠ 未通过的项数那么多风险。** 它们集中在 4 处，其中**两处**（中继升级、唤醒 Windows 机器）是可以立刻解决的。
+
+---
+
+## 三个计数必须从本表消失
+
+计划文本里反复出现的三个数字**已经不准了**，而且每传一次就更像事实：
+
+| 计划写的 | 实测（v0.45.0） |
+|---|---|
+| 79 个测试套件 | **82** |
+| 2199 项测试 | **2228** |
+| 九种聚合状态 | **6 个判定值** |
+
+**本表是这三个数字的唯一来源。** 引用它们时从这里读，不要从旧计划里复制。
+
+---
+
+## 解锁那两处阻塞
+
+**中继**（解锁 `TC-REL-001`–`004`，以及这一跨度唯一未通过的功能验证 `PROP-009`）：
+
+```bash
+scp twinsearth-w2m-dsh-plugin-0.45.0.tgz root@202.182.123.154:/tmp/w2m-pkg-0450.tgz
+bash install.sh /tmp/w2m-pkg-0450.tgz
+```
+
+`install.sh` 是幂等的，会**同时重部署和重启**服务，并保留 `/var/lib/w2m/rabbit`。做完之后 `w2m_stats` 会给出可验证的信号：`relay_id` 不变、`started_at` 变新。
+
+**两台 `win-desktop`**（解锁 `TC-REPL-001`、`TC-SPLIT-*`、`TC-ANCH-001`、`TC-AGG-001/002/004`）：它们自 2026-10-14 起静默，`last_heartbeat_at: null`。需要在那两台机器上把 DSH 拉起来。
+
+**这两件事都不需要我，而其余 32 项已经跑完了。**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/plugin/tools.mjs

@@ -208,7 +208,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.45.0';
+const PLUGIN_VERSION = '0.47.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;